CVE-2026-17134

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability (CWE-89) that allows an authenticated remote attacker to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or exfiltration.

Exploitability

Exploitation requires valid authentication credentials and the ability to send malicious input to a vulnerable endpoint; however, no public exploit code is currently available.

Blast radius

Successful exploitation could result in full compromise of backend database confidentiality and integrity, with limited impact on availability due to CVSS scoring.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, as this version contains the fix for CVE-2026-17134.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.